grails 如何自定sql执行并防止注入

 def getPersonalDiskUsage() {
        Sql db = new Sql(dataSource)
        def user = springSecurityService.getCurrentUser()['username']

        // 获取用户的个人使用情况
        //String personalDiskInfo = "select * from  CSV_0001 where user = '" + user + "'"
        def personalData = db.rows("select fromSize,toSize,freeSpace from  CSV_0001 where user=:USER", [USER: user])


        def map = [:]
        if (!personalData) {
            map.put("fromSize", 0)
            map.put("toSize", 0)
            map.put("freeSpace", 0)
            personalData.add(map)
        }
        render JsonOutput.toJson(personalData)
  }